simple-module-users 0.0.35__tar.gz → 0.0.36__tar.gz

{simple_module_users-0.0.35 → simple_module_users-0.0.36}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simple_module_users
-Version: 0.0.35
+Version: 0.0.36
 Summary: Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps
 Project-URL: Homepage, https://github.com/antosubash/simple_module_python
 Project-URL: Repository, https://github.com/antosubash/simple_module_python
@@ -24,11 +24,11 @@ Requires-Python: >=3.12
 Requires-Dist: aiosmtplib>=3.0
 Requires-Dist: cachetools>=5.3
 Requires-Dist: fastapi-users[oauth,sqlalchemy]<16,>=15
-Requires-Dist: simple-module-auth==0.0.35
-Requires-Dist: simple-module-core==0.0.35
-Requires-Dist: simple-module-db==0.0.35
-Requires-Dist: simple-module-hosting==0.0.35
-Requires-Dist: simple-module-settings==0.0.35
+Requires-Dist: simple-module-auth==0.0.36
+Requires-Dist: simple-module-core==0.0.36
+Requires-Dist: simple-module-db==0.0.36
+Requires-Dist: simple-module-hosting==0.0.36
+Requires-Dist: simple-module-settings==0.0.36
 Requires-Dist: typer>=0.12
 Description-Content-Type: text/markdown
 

{simple_module_users-0.0.35 → simple_module_users-0.0.36}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "simple_module_users"
-version = "0.0.35"
+version = "0.0.36"
 description = "Email + password user management, admin invites, RBAC-ready — replaces Keycloak for simple_module apps"
 readme = "README.md"
 license = "MIT"
@@ -21,11 +21,11 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "simple_module_core==0.0.35",
-    "simple_module_db==0.0.35",
-    "simple_module_hosting==0.0.35",
-    "simple_module_settings==0.0.35",
-    "simple_module_auth==0.0.35",
+    "simple_module_core==0.0.36",
+    "simple_module_db==0.0.36",
+    "simple_module_hosting==0.0.36",
+    "simple_module_settings==0.0.36",
+    "simple_module_auth==0.0.36",
     # Pinned to a narrow range: `deps.py` relies on mutating CookieTransport
     # fields after construction (see reconfigure_cookie_transport in backend.py).
     # Bumping the major version requires re-checking those field names.

{simple_module_users-0.0.35 → simple_module_users-0.0.36}/tests/_middleware_support.py

@@ -49,7 +49,6 @@ async def _build_app(db_state, inner_handler=None, *, principal_resolvers=None):
                         "email": user.email,
                         "name": user.name,
                         "roles": user.roles,
-                        "tenant_id": user.tenant_id,
                     }
                     if user is not None
                     else None
@@ -106,7 +105,6 @@ async def mw_active_user(db_session, _mw_seed_roles):
         is_superuser=False,
         is_verified=True,
         full_name="Middleware Tester",
-        tenant_id="acme",
     )
     link = UserRole(user_id=user_id, role_id=ADMIN_ROLE_ID)
     db_session.add_all([user, link])

simple_module_users-0.0.36/tests/test_legacy_cached_tenant.py

@@ -0,0 +1,54 @@
+"""A pre-#381 session cookie's cached ``tenant_id`` is ignored.
+
+``users_user.tenant_id`` is gone and the active tenant is resolved per request
+from memberships, but cookies signed before the upgrade still carry the old
+value inside ``user_ctx``. Honouring it would keep acting for a tenant the
+user may have left.
+"""
+
+from __future__ import annotations
+
+import time
+
+import pytest
+from auth.contracts.schemas import UserContext
+from simple_module_hosting.session import SESSION_EXPIRES_AT_KEY
+from sqlalchemy import select
+from starlette.requests import Request
+from users.models import User
+from users.provider import UsersAuthProvider
+
+
+async def _admin_id(users_app) -> str:
+    async with users_app.state.sm.db.session_factory() as session:
+        stmt = select(User.id).where(User.email == "admin@example.com")
+        return str((await session.execute(stmt)).scalar_one())
+
+
+@pytest.mark.anyio
+async def test_old_cookie_tenant_id_is_dropped_on_the_cached_path(users_app):
+    user_id = await _admin_id(users_app)
+    legacy_ctx = UserContext(
+        id=user_id, email="admin@example.com", name="Admin", roles=["admin"], tenant_id="acme"
+    ).to_session_dict()
+    session = {
+        "user_id": user_id,
+        "user_ctx": legacy_ctx,
+        "session_version": 0,
+        SESSION_EXPIRES_AT_KEY: int(time.time()) + 3600,
+    }
+    scope = {
+        "type": "http",
+        "method": "GET",
+        "path": "/",
+        "headers": [],
+        "app": users_app,
+        "session": session,
+    }
+
+    ctx = await UsersAuthProvider().resolve_user(Request(scope))
+
+    assert ctx is not None
+    assert ctx.id == user_id
+    assert ctx.name == "Admin"  # the cached context was used, not a DB reload
+    assert ctx.tenant_id is None

simple_module_users-0.0.36/tests/test_login_redirect_root_mount.py

@@ -0,0 +1,39 @@
+"""Login fallback with a module mounted at the root (#435)."""
+
+from __future__ import annotations
+
+import pytest
+
+
+def _fallback_url(app, prefixes: dict[str, str]) -> str:
+    """Run the login fallback against a Dashboard-less module set (#435)."""
+    from users.startup import apply_login_redirect_fallback
+
+    sm = app.state.sm
+    saved_mods, saved_prefixes = sm.modules, dict(sm.view_prefixes)
+    settings = app.state.users.settings
+    saved_url = settings.login_redirect_url
+    object.__setattr__(sm, "modules", tuple(m for m in saved_mods if m.meta.name != "Dashboard"))
+    sm.view_prefixes.clear()
+    sm.view_prefixes.update(prefixes)
+    settings.login_redirect_url = "/dashboard/"
+    try:
+        apply_login_redirect_fallback(app, settings, "Users", "/dashboard/")
+        return settings.login_redirect_url
+    finally:
+        object.__setattr__(sm, "modules", saved_mods)
+        sm.view_prefixes.clear()
+        sm.view_prefixes.update(saved_prefixes)
+        settings.login_redirect_url = saved_url
+
+
+@pytest.mark.anyio
+async def test_login_redirect_fallback_prefers_root_mounted_module(users_app):
+    """#435: a module that serves views at ``/`` (view_prefix == "") wins."""
+    assert _fallback_url(users_app, {"Users": "/users", "Home": "", "Other": "/o"}) == "/"
+
+
+@pytest.mark.anyio
+async def test_login_redirect_fallback_skips_api_only_module(users_app):
+    """An API-only module also has view_prefix == "" but is not in the map."""
+    assert _fallback_url(users_app, {"Users": "/users", "Other": "/o"}) == "/o/"

{simple_module_users-0.0.35 → simple_module_users-0.0.36}/tests/test_user_model.py

@@ -35,7 +35,6 @@ class TestUserTableShape:
             "is_superuser",
             "is_verified",
             "full_name",
-            "tenant_id",
             "disabled_at",
             "last_login_at",
             # AuditMixin columns

{simple_module_users-0.0.35 → simple_module_users-0.0.36}/tests/test_users_middleware.py

@@ -81,7 +81,6 @@ async def test_authenticated_request_sets_user_context(db_state, mw_active_user)
     assert data["user"]["email"] == "middleware-test@example.com"
     assert data["user"]["name"] == "Middleware Tester"
     assert data["user"]["roles"] == ["admin"]
-    assert data["user"]["tenant_id"] == "acme"
 
 
 # ---------------------------------------------------------------------------

simple_module_users-0.0.36/tests/test_users_setup_lock.py

@@ -0,0 +1,63 @@
+"""The database lock behind the first-admin wizard action, across connections.
+
+``test_users_setup_wizard`` drives concurrency through one app, where the
+in-process lock already serializes requests (and an in-memory SQLite engine
+shares one connection anyway). Two workers share neither, so the database lock
+is the real guarantee — exercised here on two real connections.
+"""
+
+from __future__ import annotations
+
+import os
+
+import pytest
+import sqlalchemy as sa
+from simple_module_db import init_db
+from sqlalchemy.exc import OperationalError
+from users.models import User
+from users.setup_action import _lock_admin_creation
+
+pytestmark = pytest.mark.anyio
+
+
+async def test_sqlite_lock_holds_off_a_second_writer(tmp_path) -> None:
+    state = init_db(f"sqlite+aiosqlite:///{tmp_path / 'lock.db'}", sqlite_busy_timeout_ms=100)
+    try:
+        async with state.engine.begin() as conn:
+            await conn.run_sync(lambda sync: User.__table__.create(sync))
+
+        async with state.session_factory() as first, state.session_factory() as second:
+            await _lock_admin_creation(first)
+
+            with pytest.raises(OperationalError, match="locked"):
+                await _lock_admin_creation(second)
+            await second.rollback()
+
+            # Released at commit: the next worker gets through and re-checks.
+            await first.commit()
+            await _lock_admin_creation(second)
+            await second.rollback()
+    finally:
+        await state.engine.dispose()
+
+
+@pytest.mark.skipif(
+    not os.environ.get("SM_TEST_DATABASE_URL", "").startswith("postgresql"),
+    reason="needs SM_TEST_DATABASE_URL pointing at Postgres",
+)
+async def test_postgres_advisory_lock_is_held_for_the_transaction() -> None:
+    state = init_db(os.environ["SM_TEST_DATABASE_URL"])
+    try:
+        async with state.session_factory() as first, state.session_factory() as second:
+            await _lock_admin_creation(first)
+            probe = sa.text("SELECT pg_try_advisory_xact_lock(:key)")
+            from users.setup_action import _PG_LOCK_KEY
+
+            assert await second.scalar(probe, {"key": _PG_LOCK_KEY}) is False
+            await second.rollback()
+
+            await first.commit()
+            assert await second.scalar(probe, {"key": _PG_LOCK_KEY}) is True
+            await second.rollback()
+    finally:
+        await state.engine.dispose()

simple_module_users-0.0.36/tests/test_users_setup_wizard.py

@@ -0,0 +1,187 @@
+"""The ``users.administrator`` wizard action: anonymous creation of the first admin.
+
+What is pinned here, in the order the action's docstring argues it:
+
+* it completes the step and releases the gate;
+* it is gated on *its own step*, so an install that re-enters setup mode with
+  administrators intact (schema behind head) refuses it;
+* it re-checks under a lock inside the inserting transaction, so concurrent
+  requests mint exactly one superuser;
+* the password goes through the module's real policy.
+"""
+
+from __future__ import annotations
+
+import asyncio
+from types import SimpleNamespace
+
+import pytest
+from fastapi import HTTPException
+from simple_module_test.setup_wizard import post_step, wizard_client, wizard_headers
+from sqlalchemy import func, select
+from users.models import User
+from users.setup import STEP_ADMINISTRATOR
+from users.setup_action import create_first_administrator
+
+pytestmark = pytest.mark.anyio
+
+_BEHIND = {
+    "current_revision": "abc123",
+    "head_revision": "def456",
+    "is_current": False,
+    "pending_count": 1,
+}
+
+
+async def _superusers(app) -> list[str]:
+    async with app.state.sm.db.session_factory() as session:
+        rows = await session.scalars(
+            select(User.email).where(User.is_superuser.is_(True), User.is_active.is_(True))
+        )
+        return list(rows)
+
+
+def _schema_behind(app, monkeypatch) -> None:
+    """Put the install back into setup mode the way a deploy-before-migrate does."""
+    app.state.migration = dict(_BEHIND)
+
+    # The gate re-reads a behind-head verdict from the database rather than
+    # trusting the boot snapshot, so the stub has to keep saying "behind".
+    async def _still_behind(*_args, **_kwargs):
+        return dict(_BEHIND)
+
+    monkeypatch.setattr(
+        "simple_module_hosting.migrations.migration_status", _still_behind, raising=True
+    )
+
+
+async def test_creating_an_admin_completes_setup(setup_pending_app) -> None:
+    async with wizard_client(setup_pending_app) as client:
+        resp = await post_step(
+            client,
+            STEP_ADMINISTRATOR,
+            {"email": "root@example.com", "password": "SetupPass1!", "full_name": None},
+        )
+        assert resp.status_code == 200, resp.text
+        assert resp.json()["result"] == {"created": True, "email": "root@example.com"}
+
+        # The gate must now release for ordinary routes, and the wizard close.
+        after = await client.get("/", follow_redirects=False)
+        wizard = await client.get("/setup")
+
+    assert after.status_code != 302
+    assert wizard.status_code == 404
+    assert await _superusers(setup_pending_app) == ["root@example.com"]
+
+
+async def test_refused_when_setup_mode_reopens_with_admins_intact(app, monkeypatch) -> None:
+    """A behind-head schema reopens the wizard, not admin creation.
+
+    ``create_app`` registers ``host.migrations`` for every install, so a live
+    deployment that ships code ahead of its migration job re-enters setup mode
+    with its administrators intact. Gated on "setup mode" this action would
+    hand an anonymous request a fresh superuser there.
+    """
+    _schema_behind(app, monkeypatch)
+
+    async with wizard_client(app) as client:
+        resp = await post_step(
+            client, STEP_ADMINISTRATOR, {"email": "intruder@example.com", "password": "Whatever1!"}
+        )
+
+    assert resp.status_code == 409
+    assert "intruder@example.com" not in await _superusers(app)
+
+
+async def test_handler_rechecks_inside_its_transaction(app) -> None:
+    """The race loser: it passed the wizard's step check, then someone else
+    committed an admin. The in-transaction re-check must refuse it."""
+    request = SimpleNamespace(app=app)
+
+    with pytest.raises(HTTPException) as exc:
+        await create_first_administrator(
+            request, {"email": "late@example.com", "password": "LatePass1!"}
+        )
+
+    assert exc.value.status_code == 409
+    assert "late@example.com" not in await _superusers(app)
+
+
+async def test_concurrent_submissions_create_one_admin(setup_pending_app) -> None:
+    clients = [wizard_client(setup_pending_app) for _ in range(4)]
+    try:
+        # Every client loads the wizard first, as concurrent operators would —
+        # once the winner commits, the wizard is gone for anyone arriving later.
+        headers = [await wizard_headers(c) for c in clients]
+        responses = await asyncio.gather(
+            *(
+                c.post(
+                    f"/setup/steps/{STEP_ADMINISTRATOR}",
+                    json={"email": f"root{n}@example.com", "password": "RacePass1!"},
+                    headers=h,
+                )
+                for n, (c, h) in enumerate(zip(clients, headers, strict=True))
+            )
+        )
+    finally:
+        for c in clients:
+            await c.aclose()
+
+    codes = sorted(r.status_code for r in responses)
+    assert codes.count(200) == 1, codes
+    # Losers are refused by the step gate or the in-transaction re-check (409),
+    # or — once the winner has closed the wizard entirely — by its absence (404).
+    assert all(code in (200, 404, 409) for code in codes), codes
+    async with setup_pending_app.state.sm.db.session_factory() as session:
+        count = await session.scalar(
+            select(func.count()).select_from(User).where(User.is_superuser.is_(True))
+        )
+    assert count == 1
+
+
+async def test_existing_non_admin_address_is_refused(setup_pending_app) -> None:
+    """create_admin leaves an existing account untouched; reporting success for
+    a step that is still pending would leave the operator stuck."""
+    from users.bootstrap import create_standard_user
+
+    async with setup_pending_app.state.sm.db.session_factory() as session:
+        await create_standard_user(session, email="user@example.com", password="UserPass1!")
+
+    async with wizard_client(setup_pending_app) as client:
+        resp = await post_step(
+            client, STEP_ADMINISTRATOR, {"email": "user@example.com", "password": "Another1!"}
+        )
+
+    assert resp.status_code == 409
+    assert await _superusers(setup_pending_app) == []
+
+
+@pytest.mark.parametrize(
+    "password,why",
+    [
+        ("        ", "whitespace-only, exactly eight characters"),
+        ("   a    ", "one real character padded to eight"),
+        ("short", "under the minimum"),
+        ("", "empty"),
+        ("12345678", "all digits — the policy rejects these"),
+    ],
+)
+async def test_weak_passwords_are_refused(setup_pending_app, password: str, why: str) -> None:
+    """``create_admin`` writes the hash directly, bypassing ``UserManager``."""
+    async with wizard_client(setup_pending_app) as client:
+        resp = await post_step(
+            client, STEP_ADMINISTRATOR, {"email": "root@example.com", "password": password}
+        )
+
+    assert resp.status_code == 422, f"accepted a password that is {why}: {resp.text[:120]}"
+    # The wizard renders this straight into its error line.
+    detail = resp.json().get("detail")
+    assert isinstance(detail, str) and detail, f"unusable error body: {resp.text[:200]}"
+
+
+async def test_malformed_payload_is_422(setup_pending_app) -> None:
+    async with wizard_client(setup_pending_app) as client:
+        resp = await post_step(client, STEP_ADMINISTRATOR, {"email": "not-an-address"})
+
+    assert resp.status_code == 422
+    assert isinstance(resp.json()["detail"], str)

{simple_module_users-0.0.35 → simple_module_users-0.0.36}/tests/test_users_shared_props.py

@@ -109,3 +109,18 @@ class TestProviderIsRegistered:
         settings module, and a stub would pass while the wiring was broken."""
         providers = getattr(app.state, "inertia_shared_providers", [])
         assert users_shared_props in providers
+
+
+class TestHomeUrlSharedProp:
+    def test_reflects_login_redirect_url(self) -> None:
+        request = _request(SimpleNamespace(settings=SimpleNamespace(login_redirect_url="/home/")))
+        assert users_shared_props(request)["homeUrl"] == "/home/"
+
+    def test_tracks_runtime_edits(self) -> None:
+        settings = SimpleNamespace(login_redirect_url="/a/")
+        request = _request(SimpleNamespace(settings=settings))
+        settings.login_redirect_url = "/b/"
+        assert users_shared_props(request)["homeUrl"] == "/b/"
+
+    def test_omitted_when_settings_are_missing(self) -> None:
+        assert "homeUrl" not in users_shared_props(_request(SimpleNamespace()))

simple_module_users-0.0.36/tests-js/LoginForm.test.tsx

@@ -0,0 +1,31 @@
+import '@testing-library/jest-dom/vitest';
+import { render, screen } from '@testing-library/react';
+import { describe, expect, test, vi } from 'vitest';
+
+import { LoginForm } from '../users/auth_local/components/LoginForm';
+
+const baseProps = {
+  email: '',
+  onEmailChange: vi.fn(),
+  password: '',
+  onPasswordChange: vi.fn(),
+  remember: false,
+  onRememberChange: vi.fn(),
+  rememberDays: 30,
+  loading: false,
+  onSubmit: vi.fn(),
+  allowSignup: false,
+  oauthProviders: [],
+};
+
+describe('LoginForm', () => {
+  test('announces a sign-in error as an alert', () => {
+    render(<LoginForm {...baseProps} error="Invalid credentials" />);
+    expect(screen.getByRole('alert')).toHaveTextContent('Invalid credentials');
+  });
+
+  test('renders no alert without an error', () => {
+    render(<LoginForm {...baseProps} error={null} />);
+    expect(screen.queryByRole('alert')).toBeNull();
+  });
+});

{simple_module_users-0.0.35 → simple_module_users-0.0.36}/users/admin/queries.py

@@ -226,16 +226,16 @@ class _UserServiceBase:
         deck labels "Pending invites" means outstanding *invitations*: a
         self-registered account that never clicked its verification mail is
         nobody's to chase.
+
+        One scan with ``COUNT(*) FILTER (WHERE …)`` per state rather than a
+        round-trip each (Postgres and SQLite >= 3.30 both support it).
         """
-        counts: dict[str, int] = {}
-        for key, condition in (
-            ("active", STATUS_CONDITIONS["active"]),
-            ("unverified", STATUS_CONDITIONS["unverified"]),
-            ("invited", STATUS_CONDITIONS["invited"]),
-        ):
-            stmt = select(func.count()).select_from(User).where(condition())
-            counts[key] = int((await self._db.execute(stmt)).scalar_one())
-        return counts
+        keys = ("active", "unverified", "invited")
+        stmt = select(*(func.count().filter(STATUS_CONDITIONS[k]()) for k in keys)).select_from(
+            User
+        )
+        row = (await self._db.execute(stmt)).one()
+        return {key: int(value) for key, value in zip(keys, row, strict=True)}
 
     async def get_with_roles(self, user_id: uuid.UUID) -> User | None:
         return await self._get_user_with_roles(user_id)

{simple_module_users-0.0.35 → simple_module_users-0.0.36}/users/auth_local/api.py

@@ -53,7 +53,7 @@ __all__ = ["enforce_auth_throughput_limit", "router"]
 # ── Rate limit ───────────────────────────────────────────────────────────────
 
 
-def get_rate_limiter(request: Request) -> LoginRateLimiter:
+async def get_rate_limiter(request: Request) -> LoginRateLimiter:
     """Return the per-app LoginRateLimiter built in UsersModule.on_startup."""
     return request.app.state.users.rate_limiter
 

{simple_module_users-0.0.35 → simple_module_users-0.0.36}/users/auth_local/components/LoginForm.tsx

@@ -105,7 +105,11 @@ export function LoginForm({
           </Label>
         </div>
 
-        {error && <p className="text-sm text-destructive">{error}</p>}
+        {error && (
+          <p role="alert" className="text-sm text-destructive">
+            {error}
+          </p>
+        )}
 
         <Button type="submit" size="lg" className="w-full" disabled={loading}>
           {loading ? t(keys.users.login.submitting) : t(keys.users.login.submit)}

{simple_module_users-0.0.35 → simple_module_users-0.0.36}/users/bootstrap.py

@@ -134,6 +134,27 @@ async def create_admin(
     return CreateAdminResult(user=existing, created=False)
 
 
+async def ensure_user_role(db: AsyncSession) -> Role:
+    """The standard ``user`` Role row, created (and flushed) if it is missing.
+
+    The seed migration normally inserts it; tests build the schema with
+    ``create_all`` and get no seed rows, so callers that attach the role must
+    not assume it exists.
+    """
+    user_role = (
+        await db.execute(select(Role).where(Role.name == USER_ROLE_NAME))
+    ).scalar_one_or_none()
+    if user_role is None:
+        user_role = (
+            await db.execute(select(Role).where(Role.id == USER_ROLE_ID))
+        ).scalar_one_or_none()
+    if user_role is None:
+        user_role = Role(id=USER_ROLE_ID, name=USER_ROLE_NAME, description=USER_ROLE_DESCRIPTION)
+        db.add(user_role)
+        await db.flush()
+    return user_role
+
+
 async def create_standard_user(
     db: AsyncSession,
     *,
@@ -153,18 +174,7 @@ async def create_standard_user(
         logger.info(_EVT_USER_NOOP, extra={"email": email, "id": str(existing.id)})
         return CreateAdminResult(user=existing, created=False)
 
-    user_role = (
-        await db.execute(select(Role).where(Role.name == USER_ROLE_NAME))
-    ).scalar_one_or_none()
-    if user_role is None:
-        user_role = (
-            await db.execute(select(Role).where(Role.id == USER_ROLE_ID))
-        ).scalar_one_or_none()
-    if user_role is None:
-        # Safety net — the seed migration normally inserts this row.
-        user_role = Role(id=USER_ROLE_ID, name=USER_ROLE_NAME, description=USER_ROLE_DESCRIPTION)
-        db.add(user_role)
-        await db.flush()
+    user_role = await ensure_user_role(db)
 
     user = User(
         email=email,

{simple_module_users-0.0.35 → simple_module_users-0.0.36}/users/contracts/schemas.py

@@ -47,7 +47,6 @@ class UserRead(CreateUpdateDictModel, SQLModel):
     is_verified: bool = False
     is_external: bool = False
     full_name: str | None = None
-    tenant_id: str | None = None
     disabled_at: datetime | None = None
     last_login_at: datetime | None = None
 

{simple_module_users-0.0.35 → simple_module_users-0.0.36}/users/deps.py

@@ -48,12 +48,12 @@ current_active_user = fastapi_users.current_user(active=True)
 current_superuser = fastapi_users.current_user(active=True, superuser=True)
 
 
-def get_mailer(request: Request):
+async def get_mailer(request: Request):
     """Return the mailer from app.state.users (built in UsersModule.on_startup)."""
     return request.app.state.users.mailer
 
 
-def get_event_bus(request: Request) -> EventBus:
+async def get_event_bus(request: Request) -> EventBus:
     """Return the event bus from app.state.sm."""
     return request.app.state.sm.event_bus
 

{simple_module_users-0.0.35 → simple_module_users-0.0.36}/users/locales/en.json

@@ -356,7 +356,11 @@
   "setup": {
     "administrator": {
       "title": "Create an administrator",
-      "description": "An account that can sign in and manage this install."
+      "description": "An account that can sign in and manage this install.",
+      "email": "Email",
+      "password": "Password",
+      "full_name": "Full name",
+      "submit": "Create administrator"
     }
   },
   "user_row": {

{simple_module_users-0.0.35 → simple_module_users-0.0.36}/users/models/role.py

@@ -6,7 +6,9 @@
 import uuid
 
 from fastapi_users_db_sqlalchemy.generics import GUID
+from simple_module_core.tenancy import TENANT_ROLE_PREFIX
 from simple_module_db.mixins import AuditMixin
+from sqlalchemy.orm import validates
 from sqlmodel import Field, Relationship
 
 from users.models._base import Base
@@ -32,3 +34,17 @@ class Role(Base, AuditMixin, table=True):  # ty: ignore[unsupported-base]
         back_populates="roles",
         sa_relationship_kwargs={"lazy": "noload"},
     )
+
+    @validates("name")
+    def _reject_tenant_namespace(self, _key: str, value: str) -> str:
+        """``tenant:*`` is the synthetic per-tenant principal namespace (#377).
+
+        A platform ``Role`` row with that prefix would be indistinguishable from
+        the active tenant's membership role on a principal, so the name is
+        refused at the model, whichever path (service, CLI, seed) sets it.
+        """
+        if isinstance(value, str) and value.casefold().startswith(TENANT_ROLE_PREFIX):
+            raise ValueError(
+                f"Role names starting with {TENANT_ROLE_PREFIX!r} are reserved for tenant roles"
+            )
+        return value

{simple_module_users-0.0.35 → simple_module_users-0.0.36}/users/models/user.py

@@ -56,7 +56,6 @@ class User(Base, AuditMixin, table=True):  # ty: ignore[unsupported-base]
     )
 
     full_name: str | None = Field(default=None, max_length=255)
-    tenant_id: str | None = Field(default=None, max_length=50, index=True)
     disabled_at: datetime | None = Field(
         default=None,
         sa_type=DateTime(timezone=True),